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1 . A method for the distributed collecting of network data traffic 
statistics, wherein said network\;omprises end systems (ES) cormected to network 
segments, comprising: 

compiling individual networks performance statistics at a plurality of said 

ESs, said performance statistics baaed on data seen at said ESs; 

transmitting data coniaining said statistics to a collector from a plurality of 



said ES; 



compiling said statistics from individual ES into group network statistics; 



and 



providing reports based on said compiled statistics, from said collector, to 



a network manager. 



2. 



The method according to claim 1 further comprising: 



transmitting data containing compiled statistics from said collector to a 



domain collector; 



compiling statistics from a muValjcy of collectors at said domain collector; 
providing reports based on s^uftcimpiled statistics, from said domain 



collector, to a network manager. 
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3. The method according to claim 1 fiirther comprising: 

including in ESs participating in siid distributing collecting an agent, said 



3 agent being an executable module invisible to a user for collecting traffic statistics. 



4. 



The method according to claitm 1 wherein said statistics collected 



2 are as defined in a stadard defined for the gathering ©f network-wide performance 



statistics. 



5. The method according to claim U wherein said statistics collected 



2 are as defined by an RJMON or RMON2 monitoring protocol. 
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6. 



The method according to claim 5 wherein said statistics collected 



2 are as defined by an RMON or RMON2 monitoring protocols published by in IETF RFC 

3 documents, RFC- 1271, RFC- 1513 and RFC- 1 75 7 and revisions. 
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1 7. The method according to claim 1 wherein said collector simulates 

2 the behavior of a standalone probe such mat said manager interacts with and configures 

3 said collector as though said collector was^a standalone probe and said collector 

4 configures said ESs. 

1 8. The method accordki^o claim 1 wherein said end systems 

2 communicate with a plurality of routers using protocols in a TCP/IP protocol suite. 

1 9. The method according to o^aim 1 wherein a plurality of said ESs 

2 communicate using an ethemet protocol. 

1 10. A bridge for use in a local area network comprising: 

2 a plurality of ports capable of transmitting and receiving data on a network 

3 segment; 

4 a plurality of shared buffer memories for buffering data received on said 

5 ports or waiting to be transmitted on said ports; 

6 a bridge controller capable of reading the source and destination addresses 

7 of a data packet received on one of said ports; and 

8 a collector for collecting data traffic statistics fi-om agents operating on 

9 other devices in the network and a proxy for receiving configuration packets fi-om a 
m 10 manager and communicating configuration data to said agents. 
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1 11. The apparatus according to claim 10 wherein said bridge collector 

2 forwards traffic statistics to a domain proxy. 

1 12. The apparatus according to claim 10 further comprising a means 

2 for generating at said collector traffic statistics for multicast packets. 

1 13. A local area network comprising: 

2 a plurality of end systems, each with a connection to a network segment 

3 wherein said end systems are capable of transmitting data on said segment and werein at 

4 least one of sai end systems includes an agent for collection of traffic statistics; and 

5 a plurality of collectors having connections to receive data from at least 

6 one agent in said ESs or fi-om at least one other collector. 
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1 14. The local area network according to claim 13 wherein said 

2 collectors are further capable of detecting multicast packets and compiling traffic 

3 statistics on said packets. 

1 15. The local area network according to claim 13 wherein said 

2 collectors are further capable of receiving probe configuration packets from a network 

3 manager and then sending configuration packets to each individual agent in the network. 

\6. A method for distributed remote network monitor (dRMON) in a 

2 LAN comprising^ 

3 deploying dRMON agents within ESs said agents implementing prior art 

4 RMON functional groups but only capturing and analyzing packets that their native ES 

5 sends or receives; \ 

6 on a regular, periodic basis having the dRMON agents forward statistics 

7 and/or captured packets rb a dRMON proxy or collector, existing somewhere on the 

8 WAN/LAN; and \ 

9 combining received agent data thereby creating at the proxy the view that a 

10 prior-art stand-alone RMON probe would have if all the ES were on the same LAN 

1 1 segment with it. \ 

1 17. The methodVccording to claim 16 wherein said proxy can mimic 

2 the SNMP responses of a prior art non-distributed RMON probe so that existing network 

3 application management software can Weract with the proxy as though the proxy were a 

4 prior art probe. \ 

1 18. The method according^ to claim 16 wherein in a default mode, ESs 

2 in the same multicast domain are treated by a\roxy as though they are on one LAN 

3 segment to RMON applications to interact with\he proxy as though it were a prior art 

4 probe and in an enhanced dRMON Managers a user is provided with the ability to 

5 combine ports and hosts in order to create Virtual DAN (VLAN) definitions to cause the 

6 monitoring function to behave as though all selected fiosts were on the same LAN 

7 segment being served by the same RMON probe with tiae dRMON collector in this 

8 embodiment creating and maintaining several such viewfe with each appearing as one 

9 interface to conventional RMON Management applicationSL 
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1 1 9\ The method according to claim 1 6 whereby said agents perform 

2 continual response mne monitoring and forward the results to the Proxy. 

1 20. me method according to claim 16 whereby said agemt software 

2 utilizes native OS APIs toVgather information about the ES that could not be via packet 

3 capture and analysis, such a^(l) Network protocol stack configurations and NIC 

4 configurations including problematic situations; (2) Application information ranging from 

5 what protocols an application is round to, to its manufacturer, version, file date and time, 

6 DLLs used and their versions, etc.;\3) System information such as memory, CPU, disk 

7 space, current resource utilizations, er^.; and (4) System performance metrics. 

1 2 L An agent for distributed network monitoring comprising: 

2 an RMON Engine for receiving a packet stream coming from a DTA and 

3 subjecting it to RMON analyses as configured via the proxy; 

4 RMON Data Structures; 

5 filters; 

6 an event generator; 

7 Down- Loadable-Modules manager; 

8 dRMON Interface Module; and 

9 a protocol interface layer. 

1 22. The agent of claim 21 implemented in the C programming 

2 language with executable code launched each time ES is started or rebooted and the agent 

3 may be tightly bound to ES adaptor driver software. Because the dRMON agent has no 

4 visible ES user interface, the ES user is totally unaware of the agents presence. 

1 23. A proxy for distributed network monitoring comprising: 

2 an agent discovery engine for automatically discovering all of the dRMON 

3 Agents within its management sphere; 

4 a time-stamper for stamping statistics and packets received from agents; 

5 an agent configuration for setting how much memory/storage to reserve for 

6 RMON data space, version management, etc.; 

7 an RMON configuration for setting filters, historical sampling intervals 

8 and other MEB-defined user-settable options; and 
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9 an updater for automatically updating agents via the network. 
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